Digital Infrastructure Bill · As enacted · Part 3 · Licensing of Major Foundational Digital Infrastructure Service Providers
17. Directions of Authority
Official textFrom Singapore Statutes Online, unchanged
The Authority may, if the Authority thinks —
it is necessary or expedient for ensuring compliance with requirements under this Part relating to the security and resilience of a major foundational digital infrastructure service provided by a licensee or a class of licensees; or
it is necessary or expedient for the effective administration of this Part,issue a written direction, either of a general or specific nature, to the licensee or each licensee within that class of licensees.
Without limiting subsection (1), a direction under that subsection may relate to —
an audit to be carried out by the licensee or an auditor approved or appointed by the Authority, on the licensee’s compliance with this Part or any code of practice applicable to the licensee;
any action to be taken by the licensee to remedy a non‑compliance with this Part or any code of practice applicable to the licensee; or
compliance with any code of practice applicable to the licensee.
The Authority may, if the Authority thinks it is necessary or expedient, direct a licensee in writing to notify its users in Singapore, who are affected or may potentially be affected by a prescribed cybersecurity threat or cybersecurity incident in respect of a computer or computer system controlled by the licensee, of the possible protective or remedial measures the users may take to prevent or reduce any or further harm arising from the cybersecurity threat or cybersecurity incident.
A direction under subsection (1) or (3) may be revoked at any time by the Authority.
Before issuing a direction under subsection (1) or (3), the Authority must, unless the Authority considers that it is not practicable or desirable to do so, give notice to the licensee to whom the Authority proposes to issue the direction —
stating that the Authority proposes to issue the direction and setting out its effect; and
specifying the time within which written representations or objections to the proposed direction may be made.
The Authority must consider any written representations or objections which are duly made before giving any direction.
Part 4
Licensing of Data Centre Operators
Part 5
Reconsiderations and Appeals
Part 6
Enforcement
Part 7
Miscellaneous
Part 8
Related Amendments to Cybersecurity Act 2018
Part 9